aechoterm-bin

maintainer zxp19821005 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt .deb binaries from ec.cdn.nantian.com.cn, which is the CDN of Nantian (南天信息), the vendor behind Aechoterm. This is the official vendor CDN, not a random personal host, so the supply-chain risk is lower than a truly unofficial host. However, the package installs a prebuilt binary application (app.asar + native node_modules) from a Chinese commercial vendor's CDN. The binary is not reproducible, the build process is opaque, and the sha256sums provide only integrity (not authenticity) guarantees. The app.asar and bundled native node_modules are executed at runtime via electron13. There is no GPG signature verification. The vendor's GitHub org (Aechoterm/Aechoterm) exists but the binaries are served from the CDN rather than GitHub releases, making independent verification harder. This is a legitimate medium-risk pattern: executed prebuilt code from a vendor CDN with no cryptographic authenticity verification beyond a hash, which is standard for many -bin AUR packages but still represents a real supply-chain trust concern if the CDN is compromised or the vendor is malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::https://ec.cdn.nantian.com.cn/${_pkgname}_${pkgver}_arm64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt .deb binaries from ec.cdn.nantian.com.cn, which is the CDN of Nantian (南天信息), the vendor behind Aechoterm. This is the official vendor CDN, not a random personal host, so the supply-chain risk is lower than a truly unofficial host. However, the package installs a prebuilt binary application (app.asar + native node_modules) from a Chinese commercial vendor's CDN. The binary is not reproducible, the build process is opaque, and the sha256sums provide only integrity (not authenticity) guarantees. The app.asar and bundled native node_modules are executed at runtime via electron13. There is no GPG signature verification. The vendor's GitHub org (Aechoterm/Aechoterm) exists but the binaries are served from the CDN rather than GitHub releases, making independent verification harder. This is a legitimate medium-risk pattern: executed prebuilt code from a vendor CDN with no cryptographic authenticity verification beyond a hash, which is standard for many -bin AUR packages but still represents a real supply-chain trust concern if the CDN is compromised or the vendor is malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=aechoterm-bin
    
      3_pkgname=Aechoterm
    
      4pkgver=4.0.2
    
      5_electronversion=13
    
      6pkgrel=3
    
      7pkgdesc="A free, cross-platform terminal and file management tool for accessing remote servers with SSH and SFTP protocols.(Prebuilt version.Use system-wide electron)闪令是一款免费的、跨平台的,以SSH、SFTP协议访问远程服务器的终端、文件管理工具"
    
      8arch=(
    
      9    'aarch64'
    
      10    'x86_64'
    
      11)
    
      12url="https://ec.nantian.com.cn/"
    
      13_ghurl="https://github.com/Aechoterm/Aechoterm"
    
      14license=('LicenseRef-custom')
    
      15provides=("${pkgname%-bin}=${pkgver}")
    
      16conflicts=("${pkgname%-bin}")
    
      17depends=(
    
      18    "electron${_electronversion}"
    
      19    'python'
    
      20    'nodejs'
    
      21)
    
      22options=('!strip')
    
      23source=(
    
      24    "LICENSE.html::${url}/privacy-agreement.html"
    
      25    "${pkgname%-bin}.sh"
    
      26)
    
      27source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::https://ec.cdn.nantian.com.cn/${_pkgname}_${pkgver}_arm64.deb")
    
      28source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.deb::https://ec.cdn.nantian.com.cn/${_pkgname}_${pkgver}_amd64.deb")
    
      29sha256sums=('cc65895a835817a900c9c2c4006a1738a6f2284cfa29eeb8283fd0043121931e'
    
      30            '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
    
      31sha256sums_aarch64=('58f37a6d3987648ab0097a843648aae2f1bc7085ea0df010d11d08f7930d18e3')
    
      32sha256sums_x86_64=('67d16a2e5aebb6d43ef7a4000c5991d62f49950b7aa3dcc48c978a764dd5250d')
    
      33prepare() {
    
      34    sed -i -e "
    
      35        s/@electronversion@/${_electronversion}/g
    
      36        s/@appname@/${pkgname%-bin}/g
    
      37        s/@runname@/app.asar/g
    
      38        s/@cfgdirname@/${_pkgname}/g
    
      39        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
      40    " "${srcdir}/${pkgname%-bin}.sh"
    
      41    bsdtar -xf "${srcdir}/data."*
    
      42    sed -i -e "
    
      43        s/\/opt\/${_pkgname}\/${pkgname%-bin} --no-sandbox/${pkgname%-bin}/g
    
      44        s/Development/Utility/g
    
      45    " "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      46    find "${srcdir}/opt/${_pkgname}/resources/app/node_modules" -type d \( -name "android-*" -o -name "darwin-*" -o -name "win32-*" \) -exec rm -rf {} +
    
      47    case "${CARCH}" in
    
      48        aarch64)
    
      49            find "${srcdir}/opt/${_pkgname}/resources/app/node_modules" -type d \( -name "linux-arm" -o -name "linux-x64" \) -exec rm -rf {} +
    
      50            ;;
    
      51        x86_64)
    
      52            find "${srcdir}/opt/${_pkgname}/resources/app/node_modules" -type d -name "linux-arm*" -exec rm -rf {} +
    
      53            ;;
    
      54    esac
    
      55}
    
      56package() {
    
      57    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      58    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      59    cp -Pr --no-preserve=ownership "${srcdir}/opt/${_pkgname}/resources/app" "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      60    install -Dm644 "${srcdir}/opt/${_pkgname}/swiftshader/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/swiftshader"
    
      61    install -Dm644 "${srcdir}/opt/${_pkgname}/LICENSE"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      62    _icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512)
    
      63    for _icons in "${_icon_sizes[@]}";do
    
      64        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png" \
    
      65            -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
    
      66    done
    
      67    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      68    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      69}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2